mod_xml_curl and https
hi all, since view hours i try to make a https request to a c# sslstream class. the same request works fine with the browser. In my descriotion the freeswitch is the web client and the c# sslstream side is the server. Is it possible to configure the xml_curl.config.xml to trust any server certificate and the certificate comes only from the server (the same that's working with the browser)? With all configurations that i try the client sends an Encryptet Alert and a [Fin, ACK]. At the moment, the server side use a *.pfx cert gerneratet with openssl. Thanks for your help.
mor information: in the trace i see client to server -> Client Hello server to client -> Server Hello, Certificate, Server Hello Done client to server -> Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message server to client -> Change Cipher Spec, Encrypted Handshake Message client to server -> Encrypted Alert. ________________________________ Von: freeswitch-users-bounces@lists.freeswitch.org [freeswitch-users-bounces@lists.freeswitch.org]" im Auftrag von "Alexander Haugg [Alexander.Haugg@c4b.de] Gesendet: Mittwoch, 6. März 2013 09:09 An: FreeSWITCH Users Help Betreff: [Freeswitch-users] mod_xml_curl and https hi all, since view hours i try to make a https request to a c# sslstream class. the same request works fine with the browser. In my descriotion the freeswitch is the web client and the c# sslstream side is the server. Is it possible to configure the xml_curl.config.xml to trust any server certificate and the certificate comes only from the server (the same that's working with the browser)? With all configurations that i try the client sends an Encryptet Alert and a [Fin, ACK]. At the moment, the server side use a *.pfx cert gerneratet with openssl. Thanks for your help.
See http://wiki.freeswitch.org/wiki/Mod_xml_curl#.3Cbinding.3E_options To verify the certificate you must set on the binding(s): ssl-cacert-path = /etc/ssl/certs/ca-certificates.crt (assuming Linux) enable-cacert-check = true enable-ssl-verifyhost = true The first is the file containing the CA certificates to verify that the certificate is signed by a trusted CA. The next tells it to do that check. The 3rd checks the common name matches that of the URL (without that any trusted signed certificate would be accepted, even on other URLs). -Steve On 6 March 2013 08:09, Alexander Haugg <Alexander.Haugg@c4b.de> wrote:
hi all,
since view hours i try to make a https request to a c# sslstream class. the same request works fine with the browser.
In my descriotion the freeswitch is the web client and the c# sslstream side is the server.
Is it possible to configure the xml_curl.config.xml to trust any server certificate and the certificate comes only from the server (the same that's working with the browser)? With all configurations that i try the client sends an Encryptet Alert and a [Fin, ACK].
At the moment, the server side use a *.pfx cert gerneratet with openssl.
Thanks for your help.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks for your Answer, i had read the Wiki page bervor i ask the question ;-) and i had try all constellations of the possible configuration, without success. I try to verify the certificate to openssl with the verify command, but on windows is the problem with the config path of open ssl. exists a solution for this? Next step i will try it with several generated new certificates they will accepted from the .net sslsocket. Von: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] Im Auftrag von Steven Ayre Gesendet: Mittwoch, 6. März 2013 10:41 An: FreeSWITCH Users Help Betreff: Re: [Freeswitch-users] mod_xml_curl and https See http://wiki.freeswitch.org/wiki/Mod_xml_curl#.3Cbinding.3E_options To verify the certificate you must set on the binding(s): ssl-cacert-path = /etc/ssl/certs/ca-certificates.crt (assuming Linux) enable-cacert-check = true enable-ssl-verifyhost = true The first is the file containing the CA certificates to verify that the certificate is signed by a trusted CA. The next tells it to do that check. The 3rd checks the common name matches that of the URL (without that any trusted signed certificate would be accepted, even on other URLs). -Steve On 6 March 2013 08:09, Alexander Haugg <Alexander.Haugg@c4b.de<mailto:Alexander.Haugg@c4b.de>> wrote: hi all, since view hours i try to make a https request to a c# sslstream class. the same request works fine with the browser. In my descriotion the freeswitch is the web client and the c# sslstream side is the server. Is it possible to configure the xml_curl.config.xml to trust any server certificate and the certificate comes only from the server (the same that's working with the browser)? With all configurations that i try the client sends an Encryptet Alert and a [Fin, ACK]. At the moment, the server side use a *.pfx cert gerneratet with openssl. Thanks for your help. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (2)
-
Alexander Haugg
-
Steven Ayre